How to Clean Malware from WordPress: A Complete Recovery Guide

A hacked WordPress site can turn into a business problem quickly. One day the site looks normal. The next, customers see browser warnings, strange redirects, spam pages, broken checkout flows, or suspicious pop-ups.

This guide explains how to clean malware from WordPress without making the damage worse. It is written for small business owners, marketing teams, and site managers who need a practical recovery process, not a vague list of security tips.

Malware cleanup is partly technical and partly procedural. You need to remove infected code, close the entry point, protect customer data, restore search visibility, and make sure the same issue does not return next week.

Key Takeaways

• Do not start deleting files until you have a backup of the infected site.
• Malware often hides in plugins, themes, uploads, database entries, cron jobs, admin users, and .htaccess files.
• Restoring from a clean backup is often safer than manually editing hundreds of infected files.
• Cleaning the visible malware is not enough. You also need to close the security gap that allowed the infection.
• After cleanup, check Google Search Console, request a review if needed, and monitor the site for reinfection.

What WordPress Malware Looks Like

WordPress malware is not always obvious. Sometimes the homepage looks fine, but Google detects malicious code on an old blog post, a hidden spam page, or a file inside the uploads folder. Google describes malware as software designed to harm a device, software, or users, and its malware documentation notes that website owners may not realize harmful files are being hosted on their own sites: Google’s malware and unwanted software overview.

For a business website, the most common warning signs include:

• Visitors are redirected to unrelated websites.
• Google Search Console shows a Security Issues warning.
• Search results display “This site may be hacked.”
• Unknown admin users appear in WordPress.
• New pages show up in Google that you did not create.
• The site sends spam emails through your hosting account.
• Checkout, forms, or login pages behave strangely.
• Your hosting provider suspends the site for abuse.
• Security plugins report suspicious PHP files.
• Files keep changing even after you delete them.

The hard part is that many infections are built to avoid detection. A hacker may show clean pages to logged-in admins while redirecting only first-time visitors, mobile users, or search engine traffic. This is why you should not assume the site is safe just because it looks normal on your laptop.

Common Types of WordPress Malware

Malware type	What it does	Where it often appears
Redirect malware	Sends visitors to spam, phishing, or scam pages.	.htaccess, theme files, plugin files, JavaScript injections
SEO spam	Creates hidden pages or links for gambling, pharma, adult, or counterfeit topics.	Database posts, hidden pages, injected template code
Backdoors	Lets an attacker regain access after cleanup.	Random PHP files, uploads folders, old plugin directories
Malicious admin users	Gives attackers dashboard access.	WordPress users table
Skimmers	Attempts to steal payment or form data.	Checkout pages, custom scripts, compromised plugins
Spam mailers	Uses your hosting account to send spam.	PHP scripts, compromised forms, weak SMTP settings

A small service business might first notice the issue when leads drop. An eCommerce site might notice it when payment pages fail or customers report strange redirects. A local business might only discover the hack after Google Search Console sends a warning.

How to Clean Malware From WordPress Step by Step

The safest way to clean malware from WordPress is to follow a controlled incident response workflow. Rushing into the dashboard and deleting random files can destroy evidence, break the site, or leave a hidden backdoor behind.

Before you begin, make sure you have access to WordPress admin, hosting control panel, file manager or SFTP, the database, Google Search Console, and your domain or DNS account. If you do not have those, involve your host or developer first. Google’s older hacked-site guidance also recommends contacting your hosting provider early because hosts can often help with the technical cleanup and server-level checks: Google’s hacked site recovery guidance.

1. Put the Site in a Safer State

If the site is actively redirecting users, hosting phishing pages, or exposing customer data, take it offline temporarily or restrict access while you investigate. For a brochure website, this may mean enabling maintenance mode at the server level. For an eCommerce store, it may mean pausing checkout until you confirm payment pages are clean.

Do not rely only on a WordPress maintenance mode plugin if the WordPress installation itself is compromised. A server-level block, host-side suspension page, or temporary access restriction is safer when the infection is active.

You should also document what you see before changing anything:

• Take screenshots of browser warnings.
• Save Google Search Console security issue examples.
• Note suspicious URLs.
• Record the date and time the issue was discovered.
• Ask your host for malware scan logs if available.

This gives you a clearer timeline and helps if you need to explain the incident to a developer, host, payment provider, insurer, or internal team.

2. Back Up the Infected Site Before Cleaning

Backing up an infected site may sound counterintuitive, but it is important. You need a copy of the current state in case the cleanup breaks something or you need to compare infected files with a clean backup.

Create a full backup that includes:

• WordPress files
• Database
• Uploads folder
• Plugins
• Themes
• .htaccess
• wp-config.php
• Server logs if available

Label it clearly as infected. Do not restore this backup later unless you know exactly what you are doing.

A clean backup is different. That is a backup from before the hack occurred. If you have a verified clean backup, it can often speed up recovery. The key word is verified. If you restore a backup from last night but the site was infected two weeks ago, you may simply restore the malware.

This is where a proper maintenance routine matters. A business that already has tested, off-site backups can recover much faster than one relying on unverified host snapshots. If backups are a weak point on your site, review how ongoing WordPress site maintenance should handle backups, updates, and security checks before an emergency happens.

3. Scan the Site From Multiple Angles

A malware scan is useful, but one scan rarely tells the full story. Use a combination of tools and manual checks.

Start with:

• Hosting provider malware scan
• WordPress security plugin scan
• Google Search Console Security Issues report
• Google Safe Browsing status
• Manual file review through SFTP or file manager
• Database search for suspicious scripts, spam links, or encoded code

The Google Search Console Security Issues report can show hacked URLs, malware warnings, and harmful behavior detected by Google: Search Console Security Issues report. This report is especially useful because it may identify pages that are not obvious from the WordPress dashboard.

Look for suspicious patterns such as:

• Recently modified PHP files in old theme or plugin folders
• PHP files inside /wp-content/uploads/
• Unknown files with random names
• Base64 encoded code in theme files
• JavaScript injected into headers or footers
• Hidden admin users
• Unknown scheduled tasks
• Strange database entries in posts, options, or widgets

Do not delete everything a scanner flags without reviewing it. Some scanners flag legitimate code as suspicious because it is compressed, encoded, or unfamiliar. When in doubt, compare the file against a fresh copy from WordPress.org, the plugin developer, or the original theme source.

4. Replace Core WordPress Files

If WordPress core files are infected, the safest fix is usually replacement, not manual editing. Download a fresh copy of WordPress from the official source and replace core files, while preserving your wp-config.php file and wp-content directory.

Do not overwrite blindly if you are not comfortable with file structure. A mistake here can break the site. The general approach is:

1. Download the same or latest stable WordPress version.
2. Delete and replace core folders such as /wp-admin/ and /wp-includes/.
3. Replace core root files, except files that contain site-specific configuration.
4. Confirm the site still loads.
5. Update WordPress core if it was outdated.

This removes malicious changes to core files and gives you a cleaner baseline. It does not clean infected plugins, themes, uploads, or database content, so it is only one part of the cleanup.

5. Remove and Reinstall Plugins and Themes

Plugins and themes are common entry points because many WordPress sites keep old, unused, or abandoned extensions installed. Even inactive themes and plugins can create risk if their files remain on the server.

For each plugin and theme:

• Delete anything unused.
• Replace active plugins with fresh copies from trusted sources.
• Replace the active theme with a clean copy from the original developer.
• Remove abandoned plugins that no longer receive updates.
• Avoid “nulled” or pirated themes and plugins completely.
• Check whether premium plugin licenses are current.

If a plugin is no longer maintained, do not just reinstall it. Find a safer replacement. A site that keeps relying on unsupported software is likely to be compromised again.

For example, a local contractor site may have an old slider plugin installed from a redesign five years ago. The slider is no longer visible on the site, but the plugin files still exist. If that plugin has a known vulnerability, attackers can exploit it even if the business owner forgot it was there.

A good cleanup includes removing that dead weight, not just patching the visible infection. For a broader view of plugin security options, compare trusted tools in the guide to WordPress security plugins.

6. Clean the Uploads Folder Carefully

The uploads folder should usually contain images, PDFs, documents, and media files. It should not normally contain executable PHP files.

Check directories such as:

/wp-content/uploads/

/wp-content/uploads/2024/

/wp-content/uploads/2025/

/wp-content/uploads/woocommerce_uploads/

Suspicious files may have names that look harmless, such as:

class.api.php

image.php

cache.php

wp-loads.php

about.php

Do not assume a file is safe because it is inside a media folder. Attackers often hide backdoors there because site owners are less likely to inspect old upload directories.

File upload security matters because attackers may abuse weak upload handling to place harmful files on the server. OWASP recommends blocking harmful file types and warns that extension blocking alone is weak if used by itself: OWASP File Upload Cheat Sheet.

After cleanup, restrict file execution in upload directories where possible. Your host or developer can usually add server rules that prevent PHP from running inside uploads.

7. Clean the Database

Some WordPress malware does not live in files. It lives in the database.

Check these areas:

• Posts and pages
• Drafts and revisions
• Widgets
• Theme options
• Plugin settings
• User accounts
• Redirect rules
• WooCommerce product descriptions
• Header and footer script fields

Search for suspicious terms such as:

<script

iframe

base64

eval(

fromCharCode

display:none

casino

viagra

pharma

loan

Be careful with database edits. A wrong change can break layouts, plugin settings, or order data. Always export the database before making changes.

For eCommerce sites, treat database cleanup with extra caution. Order records, customer accounts, payment plugin settings, and product data can be business-critical. If there is any chance customer data was exposed, involve qualified technical and legal guidance.

8. Remove Backdoors and Unauthorized Users

A site can look clean and still be compromised if a backdoor remains. Backdoors let attackers return without using the original vulnerability.

Look for:

• Unknown admin users
• New FTP or hosting users
• Unexpected SSH keys
• Unknown database users
• Suspicious cron jobs
• Hidden PHP files
• Modified wp-config.php
• Modified .htaccess
• Files with recent modification dates that do not match normal updates

Review every WordPress admin account. Remove accounts that should not exist. Downgrade users who do not need admin access. If several team members share one admin login, create separate accounts instead.

Also change passwords for:

• WordPress admins
• Hosting account
• SFTP or FTP users
• Database users if needed
• cPanel or Plesk
• Domain registrar
• CDN
• Email accounts connected to the site
• API keys and salts

Password changes should happen after cleanup, not before only. If malware is still capturing credentials, changing passwords too early may give attackers the new passwords.

9. Patch, Harden, and Test

Once the visible malware is gone, update and harden the site. WordPress.org recommends security hardening steps such as strict file permissions, safer ownership, and avoiding unnecessary write and execute permissions where possible: WordPress hardening documentation.

Important hardening steps include:

• Update WordPress core, plugins, and themes.
• Remove unused plugins and themes.
• Set correct file permissions.
• Protect wp-config.php.
• Disable file editing in the WordPress dashboard.
• Add two-factor authentication for admin users.
• Limit login attempts.
• Use a web application firewall if appropriate.
• Ensure HTTPS is active sitewide.
• Review server PHP version.
• Configure off-site backups.
• Add uptime and malware monitoring.

After hardening, test the site from a visitor’s perspective:

• Homepage
• Main service pages
• Contact forms
• Blog posts
• Login page
• Checkout flow
• Thank-you pages
• Mobile layout
• Search results snippets
• Tracking scripts

If you use caching or a content delivery network (CDN), clear all caches after cleanup. Malware can remain visible from cached files even after the source infection is removed.

How to Find the Source of the Infection

Cleaning the malware is only half the job. You also need to identify how the site was compromised. Otherwise, the infection may return.

Common causes include outdated plugins, weak admin passwords, abandoned themes, insecure hosting, compromised FTP credentials, bad file permissions, nulled plugins, vulnerable form uploads, and old developer accounts that were never removed.

A practical investigation looks at both WordPress and the server environment.

Review the Timeline

Start with file modification dates, plugin update history, hosting logs, and Search Console warnings. You are looking for the earliest sign of compromise.

Ask these questions:

• When did Google first detect the issue?
• When did traffic or leads begin dropping?
• What files changed around that date?
• Was a new plugin installed recently?
• Did a developer, VA, or contractor receive admin access?
• Did the host report spam or resource abuse?
• Were there failed login spikes?
• Did any plugin have a recently disclosed vulnerability?

You may not always find one clear answer. But the investigation often reveals a pattern.

Check Access Points

Review every way someone can access or change the site:

Access point	What to check	Why it matters
WordPress admin	Unknown users, weak roles, shared logins.	Attackers often create admin accounts for persistence.
Hosting panel	New users, file changes, backups, logs.	Server access can bypass WordPress entirely.
SFTP or FTP	Old accounts, weak passwords, unknown logins.	Compromised credentials can upload malware directly.
Database	Unknown users or modified options.	Malware may hide in site settings or content.
Plugins and themes	Outdated, abandoned, nulled, or modified files.	Vulnerable extensions are common attack paths.
Forms and uploads	File upload rules and spam entries.	Weak upload controls can allow malicious files.

If the site handles payments, memberships, medical inquiries, legal leads, or other sensitive information, do not treat the investigation as a simple website fix. You may need a deeper security review and proper incident documentation.

Compare Against a Clean Baseline

A clean baseline is a known-good version of your site files and database. If you have one, compare it against the infected version.

Look for:

• New files that should not exist
• Modified files that were not part of a planned update
• Database content added without editorial approval
• Changes to redirects
• Unknown scripts in headers or footers
• New admin users
• Plugin files that differ from official copies

This is one reason regular maintenance is so valuable. Without version history, clean backups, and update records, every cleanup becomes slower and less certain. A structured WordPress website maintenance and updates process gives your team a baseline to compare against when something goes wrong.

What to Do After the Malware Is Removed

Once the site is clean, do not stop. Post-cleanup work protects your search visibility, customer trust, and future stability.

Confirm the Site Is Clean

Run a second round of checks after cleanup:

• Rescan the site with your security plugin.
• Ask your host to rescan the hosting account.
• Check Google Search Console security issues.
• Test important pages in an incognito browser.
• Test on mobile data, not just office Wi-Fi.
• Inspect the page source for suspicious scripts.
• Check indexed pages using Google search operators.
• Review server logs for repeated suspicious requests.

You can search Google for:

site:yourdomain.com

Then scan for pages you did not create. Spam pages in search results may take time to disappear after cleanup, but they should be removed from the site itself.

Request a Google Review if Needed

If Google flagged your site, cleanup alone may not remove the warning immediately. You may need to request a review in Search Console after fixing the issue.

Before submitting the review request:

• Make sure the malware is actually removed.
• Document what was cleaned.
• Explain how the vulnerability was fixed.
• Confirm that warnings no longer appear in scans.
• Do not submit repeated review requests without making changes.

Google’s malware prevention documentation recommends monitoring Search Console because it can show hacked pages and instructions for fixing detected problems: Google’s malware prevention guide.

Rebuild Trust With Users

A hacked site can affect more than rankings. It can make customers hesitate.

Depending on the severity, you may need to:

• Notify affected customers.
• Reset user passwords.
• Reissue API keys.
• Review payment provider guidance.
• Check form submissions for suspicious activity.
• Confirm no customer data was exposed.
• Add clearer security practices internally.

Do not publish a public statement unless it is needed and accurate. But do keep internal documentation. Record what happened, what was fixed, who worked on it, and what changed afterward.

Monitor for Reinfection

Many malware cleanups fail because the team removes infected files but misses the original access point. Monitor the site closely for at least two to four weeks after cleanup.

Watch for:

• New unknown files
• Reappearing redirects
• Unexpected admin users
• Sudden traffic drops
• Search Console warnings
• Unusual server CPU usage
• Spam email reports
• Modified .htaccess
• New indexed spam URLs

Set up alerts where possible. Security monitoring is not a replacement for maintenance, but it helps you catch problems earlier.

A sensible ongoing security routine should include backups, updates, malware scanning, uptime monitoring, access control, and periodic review. These practices overlap with broader website security best practices because WordPress security depends on the whole environment, not one plugin.

When to Get Professional WordPress Malware Help

Some WordPress malware issues are safe for a technically confident site owner to handle. Others are not.

You should get professional help if:

• The site handles payments or sensitive user data.
• Google or browsers show security warnings.
• The infection returns after cleanup.
• Your host suspended the account.
• You found unknown admin or hosting users.
• You see PHP files inside uploads.
• Search results show spam pages you cannot find in WordPress.
• You do not have a clean backup.
• You are unsure which files are safe to delete.
• The site is mission-critical for leads or revenue.

Professional cleanup is not just about running a scanner. A proper malware response should identify the infection, preserve backups, clean files and database entries, remove backdoors, patch the vulnerability, harden the site, check search visibility, and document the work.

DIY Cleanup vs. Professional Cleanup

Situation	DIY may be reasonable	Professional help is safer
Small brochure site	You have clean backups, no customer data, and basic technical skill.	You cannot access files, database, or hosting logs.
eCommerce site	Very limited issue on a non-checkout page.	Checkout, accounts, orders, or payment scripts may be affected.
Google warning	You understand Search Console and can verify cleanup.	Security Issues show multiple infected URLs or repeat warnings.
Reinfection	You found and fixed the exact source.	Malware returns after deletion.
Custom code	You know the custom theme or plugin structure.	You cannot tell custom code from malicious code.

For example, imagine a small dental office website that suddenly redirects mobile visitors to a spam site. The desktop version looks fine. A basic plugin scan reports nothing, but Search Console lists several hacked URLs. In this case, the issue may involve conditional redirects, cached scripts, injected database options, or server-level changes. Deleting a few suspicious files is unlikely to be enough.

A better response would be to clone the site, preserve the infected copy, compare files against clean versions, review access logs, clean the database, replace compromised components, rotate credentials, and submit a Search Console review after verification.

A Safer Way to Handle WordPress Malware

The best malware cleanup is careful, documented, and complete. The goal is not just to make the warning disappear. The goal is to restore a trustworthy website.

If you need to clean malware from WordPress, start by stabilizing the site, backing up the infected version, scanning from multiple sources, replacing compromised files, cleaning the database, removing backdoors, changing credentials, and hardening the installation. Then monitor the site closely and fix the maintenance gaps that allowed the problem in the first place.

A cleaned site should be safer than it was before the hack. Otherwise, the same weakness is still waiting to be used again.

FAQs